Zajimat by Te mohlo asi tohle:
prvni GW je VPN server, druha je normalni firemni a pak jen delim preroutingem co ma kam jit...
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=172.20.0.1 routing-mark=tunnel scope=30 target-scope=10
add disabled=no distance=2 dst-address=0.0.0.0/0 gateway=10.10.10.1 scope=30 target-scope=10
/ip firewall mangle
add action=mark-connection chain=prerouting disabled=no dst-address=10.0.0.0/8 new-connection-mark=local-traffic passthrough=yes src-address=10.0.0.0/8
add action=mark-routing chain=prerouting disabled=no dst-address=10.0.0.0/8 new-routing-mark=main passthrough=no src-address=10.0.0.0/8
add action=mark-routing chain=prerouting comment="OVPN address list" disabled=no dst-address-list=OVPN new-routing-mark=tunnel passthrough=no
add action=mark-routing chain=prerouting comment="PORT FORWARD" disabled=yes dst-port=8904 new-routing-mark=tunnel passthrough=no protocol=tcp
V address-listu 'OVPN address list' mam cilove adresy, ktere chci aby sly tunelem, jinak nechavam provoz bezet po firemni siti, jen to, co potrebuji jde tunelem, tedy 192.168.0.0/16 a pak nejake verejne, sem tam nejaky ten port bez ohledu na IP (treba 8291, protoze z nejakeho duvodu neni na firemni siti povoleny :-) )...
pokud chci docasne uplne vsechno poslat do tunelu, tak si aktivuji pravidlo
add action=mark-routing chain=prerouting comment="ALL to vpn" disabled=yes new-routing-mark=tunnel passthrough=no src-address=10.10.10.130
